Critical Vulnerability in Linux Package: Fix for ath12k Bitrate Mask Issue
Summary
DEBIAN-CVE-2024-56607: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask() When I try to manually set bitrates: iw wlan0 set bitrates legacy-2.4 1 I get sleepin... Affects linux versions < 6.12.5-1. Fixed in 6.12.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionality for managing hardware and system resources. It is widely used across various distributions and is crucial for system stability and performance. The package includes drivers for network interfaces, including wireless components, which are vital for connectivity. This vulnerability specifically affects the ath12k driver, which is responsible for managing certain wireless chipsets.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ath12k driver related to the function ath12k_mac_op_set_bitrate_mask(). This issue arises when attempting to set bitrates manually, leading to a 'sleeping from invalid context' error. This can cause system instability and crashes, particularly when using the WCN6855 firmware, which may not support bitrate WMI commands. The vulnerability is rooted in improper handling of atomic calls, which can lead to unexpected behavior and potential denial of service.
How To Fix
Minimum fixed version
6.12.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the ath12k_mac_op_set_bitrate_mask() function until the patch is applied. This may involve configuring wireless settings through alternative methods or using different drivers if available.
Conclusion
The vulnerability in the Linux package's ath12k driver poses significant risks to system stability and wireless connectivity. Users are advised to update to the latest patched version to mitigate these risks. Temporary workarounds are available, but applying the fix is the best course of action.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of atomic calls in the ath12k driver, which can lead to system crashes when setting bitrates.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploiting this vulnerability can lead to system instability, crashes, and denial of service, particularly affecting wireless connectivity.
Yes, updating to the patched version 6.12.5-1 or later will resolve the vulnerability.
If immediate updating is not possible, avoid using the affected function and consider alternative configurations for your wireless settings.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
